279 reputation
12
bio website
location
age
visits member for 3 years, 3 months
seen May 7 at 5:28

May
15
awarded  Yearling
Jan
27
answered What is the worse that could happen if a government wanted to interfere with a CA?
Jan
27
answered What is the best way to hand out passwords to a widely spread diverse employee base?
Aug
10
answered Are jailbroken iPhones an enterprise security risk?
Jun
6
answered Is the argument really over on SSO?
May
28
answered Resources for physical security questions
May
28
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
@AviD: Well, my answer was rather stupid anyway: what I wanted to say that accepting the risk is an acceptable behavior as long as the risk has been assessed in a proper manner. I guess the main question for a startup is: "how much will bypassing security in the beginning cost us in the future?" Tough question, but has to be asked ...
May
16
comment How is “something you have” typically defined for “two-factor” authentication?
@Rakkhi: Not entirely. There still is the notion of a crypto token. Would you consider a hacked iPhone (with that cool "no PIN hack") or a malware-ladden Droid to be a trustworthy crypto token?
May
16
comment Looking for an open risk assessment methodology
@Ben meant you of course ;).
May
15
awarded  Supporter
May
15
comment Looking for an open risk assessment methodology
@Bob good to know, please do not underestimate the OSSTMM as "only" beeing a testing methology (yeah, despite the name). The link between classical risk assessment and the OSSTMM is described here
May
15
answered Looking for an open risk assessment methodology
May
15
comment How is “something you have” typically defined for “two-factor” authentication?
@John: you are right. Whatever " a secure authentication protocol " might be in that case.. Otoh, on p. 34 of the NIST-docu, the different authentication token are described. And this definitely rules out written down TANs.
May
15
answered How is “something you have” typically defined for “two-factor” authentication?
May
15
awarded  Teacher
May
15
answered Is there a strong challenge to be made against the startup executive that believes security must be delayed?